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1.        INTRODUCTION 

Modern  DOD  contracts  frequently  include  incentive  provisions   for 
the  reliability  of  the  design  used  in  building  components  of  missiles, 
or  a  complete  missile  itself.      Such  an  incentive  provision  commonly 
states  that  a  target  reliability   (negotiated  jointly  by  the  government 
and  the  contractor)    and  a  nominal  reliability  fee  be  paid  for  achieve- 
ment of  the  target  reliability.      If  the  contractor  can  demonstrate  a 
higher  reliability  than  the  target  value,    he  will  receive  more  than  the 
nominal  fee;    if,    on  the  other  hand,    his  demonstrated  reliability  is  less 
than  the  target  value,    he  receives  less  than  the  nominal  fee.      Thus,    the 
contractor  has   great  incentive  to  demonstrate  as  high  a  reliability  value 
as  he  possibly  can. 

Unfortunately,    the  individual  items  covered  by  such  contracts 
(component  parts  or  complete  missiles)    are  generally  very  expensive, 
so  a  relatively  small  number    N   of  items  are  funded  for  actual  testing. 
In  some  instances,    all    N   funded  items  may  be  tested  simultaneously; 
failures  that  occur  may  then  be  analyzed,    and  the  contractor  may  make 
design  changes  which  are  intended  to  remove  the  causes  of  the  observed 
failures.      However,    if  no  further  items  are  available  to  be  tested,    then 
the  actual  achieved  reliability  of  the  changed  design  cannot  be  estimated 
from  test  results,    and  yet  the  contractor  would  like  to  take  advantage 
of  any  improvement  in  reliability  which  the  change  may  have  effected. 
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A  specific  model  for  describing  this  sort  of  situation  is  given  by 
Corcoran,    Weingarten,    and  Zehna   [1]  .       They  assume  that    N   items 
are  tested,    each  of  which  performs  successfully   (passes  the  test)    or 
fails.      Those  items  that  fail  can  be  classified  as  falling  into  one  of   K 
different  failure  modes.      (Thus,    we  might  think  of  the  items  as  con- 
sisting of   K    components  in  logical  series;    the  item  passes  if  and  only 
if  all   K    components  operate  correctly,    and  will  fail  if  any  single  one 
of  the  components  does  not  operate  correctly.      Note  that  no  two    (or 
more)    of  these  components  can  fail  simultaneously.  )     It  is  assumed  in 
[1]    that  the  probability   a.    of  correcting  the    r-n    failure  mode    (by  the 
design  change)    is  known,      i    =    1  ,    2,    ...,    K,      for  every  failure  mode 
that  occurs  in  the    N   tests.      It  is  pointed  out  in   [  1]    that  the  achieved 
reliability    (subsequent  to  all  design  changes)    then  is  a  random  variable 
whose  value  is  unknown   (since  the  probabilities  of  success  and  of  the 
occurrence  of  the  various  failure  modes,    for  the  original  design,    are 
not  known  quantities)  .       The  paper  by  Corcoran,    Weingarten,    and  Zehna 
then  goes  on  to  define  a  quantity  called  mean  reliability  and  to  discuss, 
prior  to  any  experimental  results  being  available,    ways  of  estimating 
mean  reliability. 

Larson   [  3]    points  out  that  any  actual  estimation  of  the  achieved 
reliability   (or  more  correctly,    of  some  facet  of  its  probability  law) 
occurs  only  after  the  results  of  the    N   tests  are  available,    and  thus  it 
would  seem  reasonable  to  refer  only  to  the  conditional  distribution  of  the 
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achieved  reliability,    given  the  results  of  the    N   tests.      This  distribution 
is  derived  in   [  3]  .      He  then  speculates  upon  a  method  of  calculating  a 
lower  bound  for  a  confidence  interval  statement  about  the  achieved  re- 
liability which  does  not  require  knowledge  of  the  probabilities  of  success 
or  of  the  occurrence  of  the  various  failure  modes  for  the  initial  design. 
Earnest   [2]    mentions  this  speculated  method  and  points  out  that  it  seems 
extremely  difficult  to  apply  in  practise  for  values  of  interest  for  the 
bounding  statement.      Earnest  then  goes  on  to  discuss  a  measure  of  re- 
liability defined  by  Corcoran,    Weingarten,    and  Zehna,    and  to  discuss 
this  quantity  and  its  properties  with  an  assumed  prior  distribution  on 
the  probabilities  of  success  and  the  occurrence  of  the  various  failure 
modes. 

It  is  the  purpose  of  this  paper  to  use  the  conditional  distribution  of 
achieved  reliability  derived  in  Larson    [3]    and  a  prior  distribution  for 
the  parameters  discussed  by  Earnest    [2]    to  derive  the    (marginal)    con- 
ditional distribution  of  achieved  reliability,    independent  of  the  proba- 
bilities of  success  and  of  the  occurrence  of  the  various  failure  modes. 
This   distribution  can  then  be  used  to  make  any  kind  of  probability  state- 
ment of  interest  regarding  the  achieved  reliability   (conditioned  on  the 
outcomes  of  the    N   tests)  .      Section  2  is  devoted  to  a  discussion  of  the 
assumed  prior  distribution  and  to  a  method  of  choosing  the  prior  given 
information  on  the  individual  failure  modes  themselves.     Section  3  then 
derives  the    (marginal)    conditional  distribution  of  achieved  reliability, 
and  section  4  presents  a  numerical  example  using  synthetic  data. 
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2.        THE  PARAMETERS  AND  THEIR  PRIOR  DISTRIBUTION 

We  shall  adopt  the  notation  used  in  both   [  1]    and   [3]  .      We  assume 
that    N   items  have  been  tested  and  that  we  observe    N      successes  and 

N     failures  in  the    itn   mode,      i    =    1  ,    2  ,    ...,K.       The  initial  reliability 

i 

(for  the  initial  design)    is    p      ,      while  the  probability  of  occurrence  of 

the    ith    mode  is    q.   ,       i   =    1  ,    2  ,    .  .  .   ,    K  .      Thus,      N    ,    N     ,    .  .  .   ,    N 

l  OIK 

constitute  a  sample  of  a  multinomial  random  variable  with  parameters 

N,    PQ>    qr     ...    .    qK. 

Those  failure  modes  that  occur  in  the    N  tests  are  identified  and 
analyzed;    a  change  is  made  in  the  initial  design  to  attempt  to  remove 
some  or  all  of  these  occurring  failure  modes.      The  probability  that  the 
i        failure  mode  is  corrected  is    a.  ,     a  known  quantity.      Note  that  this 
model  does  not  allow  for  any  decrease  in  reliability  to  occur.      Prior 
to  the    N   tests  the  probability  of  the  first  failure  mode  occurring  was 
q     ,     while  after  the    N   tests    (assuming  this  mode  did  occur)    the  prob- 
ability of  the  first  mode  occurring  is  either   still    q      or    0  ,     depending 
on  whether  the  corrective  action  was   successful.      In  any  event,    there 
is  no  chance  of  the  probability  of  occurrence  of  this  mode  having  been 
increased  as  a  result  of  the  change  in  design,    within  the  framework  of 
this  model. 

Let  us  examine  the  unknown  parameters    p     ,    q    ,    .  .  .   ,    q      a  little 
more  closely.     As  defined  in   [  1  ]     (and  used  in   [2]    and   [3]   )  , 

p     ,    q    ,    .  .  .   ,    q        are  the  probabilities  of  a  single  multinomial  trial 
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falling  into  one  of  the    K  +   1     classes:     success,    failure  in   itn    mode, 

K 
i  =    1,    2,    ...  ,   K;    thus,     p       +      £    q.     =     1  .      If,    as  was  indicated  in 

i=l 
the  introduction,    the  design  concerned  is  for  an  item  which  consists  of 

K    subcomponents  connected  in  series,    so  that  the  complete  item  will 

pass  the  test  if  and  only  if  all   K    subcomponents  operate  correctly,    then 

information  collected  on  subcomponents  can  be  used  to  get  an  indication 

of  the  value  of  p      and  the    q.'s   ;    and  this  information,    in  turn,    can  be 

used  to  construct  a  reasonable  prior  distribution  of  the  parameters. 

To  illustrate  the  connection  between  the  parameters    p    ,    q    ,    .  .  .   ,  q 

0         1  K 

of  the  item  contracted  for  and  the  probabilities  that  the  individual  sub- 
components will  work  correctly,    let   p.      be  the  probability  that  the    i™ 
subcomponent  works  correctly,      i=    1,    2,    ...,    K;     and  thus     1    -    p. 
is  the  probability  that  this   subcomponent  does  not  work  correctly. 

Then,    if  the  subcomponents  operate  independently  within  the  item,    we 

K       ;,c 
have      p       =      II    p.     .      This  does  not  exactly  jibe  with  the  assumption 

i=l 
that  no  more  than  one  failure  mode  can  occur  at  a  time,    but  does  not 

represent  a  serious  inconsistency  for  the  uses  envisaged  for  this  model. 

The  probability    q      that  the  first  failure  mode  occurs  should  increase  and 

decrease  as      1    -    p         increases  and  decreases;     it  would  seem  con- 


sistent to  define 


qi 


pi  K 


K 
K     -      L    p 


['-^n 


3=1      J 
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and,    similarly,    to  define 


1  P 


q.     - "  1     -    n    p.      I   ,       i=2,3,...,K. 

K    -    2   p.* 

We  then  satisfy  the  requirement  that 

pQ    +    L  q.     ^     1      , 

and  we  have  defined   q.'s    that  vary  directly  with  their  corresponding 

(1     -    p.    )  's  ,      as  they  should.      Failure  data  on  subcomponents   could  then 

be  used  to  get  estimates  of    p     ,    q    ,    .  .  .   ,    q        and  to  estimate  parameters 

0         1  K 

of  the  prior  distribution  of    p„  ,    q     ,    .  .  .   ,    q 

i>  ^0       Ml  MK 

In  using  a  Bayesian  approach  to  solve  a  problem,    it  is  generally 
necessary  to  act  as  though  the  parameters  of  the  problem  are  themselves 
random  variables.      We  then  have  a  prior  distribution  of  the  parameters 
(measuring  our  degree  of  belief  as  to  their  values)    which  can  be  used  in 
a  variety  of  ways.      In  the  context  of  the  problem  under  discussion  here, 
we  shall  assume  that  the  probabilities  of  observing  a  success  or  of  ob- 
serving a  failure  in  any  one  of  the  possible  modes  are  random  variables; 
we. shall  denote  the  random  variables  by  capital  letters  and  the  particular 
values  which  they  can  take  on  by  lower  case  letters.      Thus,      P      is  the 
probability  of  observing  a  success  when  one  of  the  items  is  tested,    and 

Q.    is  the  probability  of  observing  a  failure  in  mode    i  ,     where 

K 
P„    +     E    Q.     =     1   ,     as  before. 
°  1         ' 


An  assumed  prior  distribution  for    P     ,    Q Q        should  satisfy 

0  1  K 

several  criteria.      First,    it  should  be  such  that  it  is  capable  of  repre- 
senting the  assumed  subjective  distribution  of    P     ,    Q    ,    .  .  .   ,    Q        . 

0  1  K 

Second,    it  should  be  a  distribution  which  is  relatively  easy  to  manipulate 

analytically   (for  the  chosen  problem)    and  not  one  which  unnecessarily 

increases  the  mathematical  analysis  or  the  final  computations  in  arriving 

at  the  desired  solution.      The  parameters  of  the  assumed  prior  should 

be  capable  of  easy  evaluation  on  the  basis  of  previous  information.      In 

the  context  of  the   current  problem,    then,    any  chosen  prior   should  be 

such  that  it  is  non-zero  only  over  the  possible   ranges  of   P      and  the 

Q.'s  ,     namely  on  the  simplex  described  by    P      >    0,      Q     ^    0  , 
i  0  l 

K 

i=l,2,...,K,      P„    +      £     Q.     =     1     .       Also,    in  the  context  of  the 

°  i=l       l 

current  problem,      P     ,    Q    ,    .  .  .   ,    Q        should  not  be  independent  random 

0  1  K 

variables  because  of  their  structure. 

Silva    [  5]     (also  reported  in  Earnest   [  2]  )     gives  a  form  of  the 

multivariate  beta  density  function  which  would  seem  ideal  for  a  prior 

distribution  for     P     ,    Q     ,    .  .  .   ,    Q       .       Defining     Q    =     (  Q         ....    Q     )  , 

U  1  rv  —  i  is. 

K 

q     =     (q     ,    .  .  .    ,    q     )  ,       p       =     1     -      2     q.    ,       this  distribution  can  be 
—  1  K.  0  l 

1=1 

written 

m      -    1  K  m.    -    1 

Vs>  =  gp0  n    q. 

—  i=l 


for      q.    s    0  ,      p„    >    0  ,      and    p       +     2  q.     =     1    ,      and 
l  0  0  l 
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fQ   (q)     =     0    , 


otherwise.      The  constant 


G     =  r(m> 


K 

n  r  (m.) 

i=0 


K 
and      m    =      L      m.   ,     where     m.   >    0    ,      for  all    i  .      It  can  be  shown  that 

i=0        l 
this  prior  is  quite  versatile,    in  the  sense  of  being  able  to  distribute  the 

degrees  of  belief  as  to  the  values  of    P     ,    Q     ,    .  .  .   ,    Q       widely  over 

0  1  K. 

the  simplex   (by  changing  the  values  of  the    m.'s)    and,    as  we  shall  see, 
it  is  quite  easy  to  use  in  the  current  context.      It  also  includes  depen- 
dence between     P     ,    Q     ,    .  .  .   ,    Q      ,     as  was  mentioned  would  be 
0  1  K 

m. 

desirable.      Silva  shows  that      E  [Q.l     =    ,       i    =     1,2,...,K 

l  m 

mo 

(and  thus      E  [  P     ]     =     )  ,     and  then  suggests  that  prior  estimates 

or  values  of  the  mean  values  of  the    Q.'s    can  be  used  to  determine  the 

i 

ratios     .       This  leaves  only  the  parameter    m   to  be  specified  (in 

m 

order  to  completely  determine  the  prior)  ;     Silva' s   suggestion  at  this 
point  is  to  use  as  the  value  of  m   that  number  which  minimizes  the  sum 
of  squares  of  deviations  between  the  prior  estimates  of  the  variances  of 
Q    ,    Q_  ,    .  .  .   ,    Q        and  the  variances  imposed  on  these  random  variables 

1  L.  K 

by  the  form  of  the  assumed  prior.      The  value  of  m    which  achieves  this 
minimization  is 


£      [E  (Q.)  ]2    [1     -    E  (Q.)  ]2 

111 1 _     i      , 

K 

2       V.     E  (Q.)     [  1     -     E  (Q.)  ] 

11  i 

i=l 


where     V.     is  the  prior  variance  of    Q.   . 
l  c  i 

The  foregoing  discussion  on  the  assignment  of  values  to  the 

parameters     m     ,    m     ,    .  .  .   ,    m     ,    m     has  been  presented  because  it 
1  Z  K. 

is  directly  applicable  to  our  reliability  growth  problem.      To  illustrate 

this,    let  us  assume  that  the  design  we  are  considering  is  for  an  item 

which  consists  of   K    subcomponents   connected  in  series.      Let    P        be 

l 

the  true  unknown  probability  that  the    itn    component  will  work  correctly, 

i   =    1  ,    2,    ...  ,   K,     as  before    (except  now  we  are  thinking  of  these  as 

K         # 
random  variables)  ,     and  define        P       =      fl     P. 

1      -     P- 
Q.     =     • '  1     -    n  P .    ]  ,      i=l,2,...,K. 

K     -    L  P. 

J 

We  assume  that  failure  data  is  available  for  each  of  the    K    subcomponents, 
This  failure  data  consists  of    r.    subcomponents  of  the  given  type  having 

been  tested  under  realistic  conditions,    and  we  know  the  number,    X.  , 

l 

of  these  that  performed  satisfactorily,      i=    1,    2,    ...,    K.      Then  the 

maximum  likelihood  estimator  of    P.      (thought  of  as  being  a  constant)    is 

X. 

P.      =     —     ,       i=l,2,...,K      , 
i  r. 

l 
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and  the  estimated  variance  of  this  estimator  is 

p.'  (i  -  p.'  > 
v.   =      l 


i  r 

1 

it  is  reasonable,    in  general,    to  assume  that  the  various  samples  are 
independent.      We  can  then  define 

1     -    P. 
Q.    =    !r7-      [  1     -    n   P.    ]  ,       i=l,2,...,K, 

K    -    L  P. 

i 

and  it  seems  reasonable  to  use  this  quantity  as  our    a  priori  estimate 

of  the  mean  of   Q.  ;      thus,      Q,  ,    Q„  ,    .  .  .   ,    (D        will  determine  the  ratios 
l  12  K 

mi  m2  mK  -  * 

,      ,    .  .  .   ,    .       For  realistic  values  of    P.      (say  from    .  9  to  1)  , 

m  m  m  l 

the  quantity 

i   -  n  p.* 

1 


K     -     L  P 

l 


will  not  differ  by  a  great  deal  from    1   ,      and  thus  the  variance  of    Q. 

a.    ;•< 

should  not  be  much  different  than  the  variance  of     1     -    P       ;     it  should, 

l 

in  fact,    be   slightly  smaller  than  that  of      1     -    P.     .       Thus,    since  the 

variance  of     1     -    P.      is  the  same  as  the  variance  of    P      ,      we  will  be 

l  l 

conservative  in  using     V.     as  the    a  priori  variance  of      Q.    , 

i=    1  ,    2,    ...,    K.      Then   m    is  determined  by  Silva's  least  squares 

method  to  be 

~       2  ~       2 

L   [  Q .  ]      [  1     -    Q.  ] 


m     = 


L  V.  Q.  [1    -   Q.  ] 

ii  i 


10 


and  we  then  have  completely  specified  a  reasonable  prior  for 

pcr  Qi qk- 

The  next  section  gives  the  derivation  of  the  marginal  distribution 
of  true  reliability    Z  ,     after  corrective  action,    conditional  on  the  out- 
comes of  the    N    items  tested;     it  also  displays  the  computation  of  a 
number    b    such  that  we  are  9  5  percent  certain  that    Z    exceeds    b  , 
given  the  outcome  of  the  tests    (or  any  other  level  of  confidence  desired) 


-   11    - 


3.       MARGINAL  DISTRIBUTION  OF    Z 

We  are  given  that    N    items  are  to  be  tested;     each  item  is  either 

a  success  or,    if  a  failure,    falls  into  one  of   K   possible  distinct  modes. 

The  probability  of  success  for  a  given  item  is    P      ,      and  the  probability 

that  the  item  fails  in  mode  iisQ,      i=l,2,...,K.      The  joint 

i 

prior  of    P     ,    Q    ,    ....    Q        is  the  multivariate  beta,      f      (  q)   , 
OIK  w     — 

described  in  section  2  .      The  number  of  successes  observed   (in  the 

N   tests)    is    N     ,      and  the  number  of  failures  observed  in  mode  i    is 

N.   ,      i     =     1  ,    2  ,    .  .  .  ,    K    (many  of  these    N. '  s    may  be  zero)  .      As  sume 

that  we  observe       N      =    n    .      N      =    n      ,    .  .  .    ,    N       =     n       with     N  =    0   , 

0  0  11  s  s  s  +  i 

i=l,2,...,K-s;     the  probability  of  this  occurring,    given  values 

Pn    =    pn   ,      Q.    =    q.   ,      i    =    1  ,    2,    .  .  .   ,    K  ,    is 
0  0  l  l 

PN|Q(^a>     =      n    !    n    ,    ...    n    ;       P0  "     \ 

1    —  0        1  s  i=l 


The  posterior  for    Q   then  is 


f  ,      I      »  I(N+    m)  n0    +    m0    "    1      «        n.    +   m.    -    1 

n    r  (n    +  m  )  1_1 

i=l 


where     n  =    n        _     =     ...=    n        =0.      (See  Earnest  [  21    for  this 

s+ls+2  K  LJ 

derivation.  ) 

Larson   [3]     shows  that  if  we  let    A   be  the  event    N      >     0  ,     N     >    0 
.  .  .   ,    N      >     0     and  define    Z    to  be  the  achieved  reliability  through  the 
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design  changes    (a.   ,     the  probability  that  the    i*"    failure  mode  is  re- 
moved,   is  known)  ,     the  conditional  probability  function  of    Z  ,    given    A  , 
is  as  follows: 


P  (Z     =     z  |  A) 


P0    +    qi 


P0    +     q2 


P0    +     qs 


P0    +     qi     +     q2 


^o  s  -  1  Ms 


PQ     +       L    q. 


n     (1     -     a.) 

1=1 


a         n     (1     -     a   ) 
i=2 


a     (1     -    a    )     n    (1     -     a.) 
2  1        3 


s-1 
a       n     (1     -    a.) 
S      1 


a,    a       n    (1 

1      L     3 


a.) 

i 


s-2 

a  a         II    (1     -    a.  ) 

s    -    1      s  1 


n    a. 
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Theproductof     f     .       (q  I  n)     and     P  ( Z    =    z  I  A)     gives  the  joint  distri- 
Q    N     —  '  — 

bution  of  the  parameter    Q   and  the  achieved  reliability    Z  ,     given  the 

results  of  the    N   items  tested.      If  we  now  integrate  this  over  the 

ranges  of  the  variables  in   q,     we  are  left  with  the  marginal  of    Z  , 

given  the  results  of  the    N  tests. 

s 
As  we  have  seen,     Z    is  equal  to    P      with  probability       n     (1     -    a.  )  ; 

i=l 
then  the  marginal  of    Z  ,     given    A,     is  equal  to  the  marginal  posterior 

density  of    P       with  this  probability.      Z    is  equal  to     P      +    Q       with 

s 
probability     a        II     (1     -    a.  )  ;    then  the  marginal  of    Z    is  equal  to  the 

1    i=2  l 

marginal  posterior  density  of    P      +    Q       with  this  probability. 

Proceeding  in  this  manner  through  the  various  values  of    Z  ,     we  see 

that  the  marginal  of    Z    consists  of  a  weighted  sum  of  the  marginal 

posterior  densities  of     P     ,    P      +    Q     ,    P      +    Q     ,    .  .  .  , 

P      +    Q      +    Q      +    .  .  .     +    Q     ,     where  the  weights  are  simply  the  values  of 

s 
the  probability  function  of    Z  ,    given  A  ;    thus,    there  are    2      terms  in 

this  sum.      It  remains  merely  to  derive  the  actual  form  of  the  posterior 

density  of  such  variables  as      P      +    Q      +    Q      .       For   simplicity  let  us 

explicitly  derive  the  marginal  posterior  density  of    P      +    Q      +    Q      ; 

U  i  £* 

all  of  the  densities  of  the  other  sums  will  have  the  same  form. 

We  assume  then  that  we  have  tested    N   items  and  observed   n 

successes,      n     failures  in  mode    i  ,     with    i=    1,    2,    ....    s    ,      and  no 
l 

failures  in  modes     s+1,     s    +    2,...,K.       Using  the  prior  given  in 
section  2,    Silva   (and  Earnest)    shows  that  the  posterior  density  of 
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P    ,   Q    .....   Q       is 

0         1  K 


fQiN(alN) 


Gi  po 


no  +  mo 


1      s 


n    q 
1=1 


n.    +    m. 
l  l 


1        K 


n     q 

j=s+l      • 


m.    -    1 
l 


where 


r  (N   +    m) 


s  K 

n  r (n.  +  m.)     n    r(m.) 

i=l  X  1     j=s+l  J 


K 
with     p       >     0  ,      q.     £     0   ,     for  all    i  ,      and      p       +      L     q.     =     1     .       To 

i=l 
derive  the  marginal  of    P    ,    Q     ,    and   Q      we  need  to  integrate  out 

Q    ,    .  .  .   ,    Q        in  the  above  density.      By  a  straightforward  extension  of 

results  given  by  Earnest,    this  is 


fPQ,    Q        Q2|N(P0'    V    q2lN)     =    GZ    P0 


0  0 


ni    +    mi    -    l  n2   +    m2    -    1 


(i  -  p0  -  qi  -  V 


N   +    m    -    (n      +    n      +    n2  )    -    (m      +   m      +   m     )    -    1 


where 


r(N    +    m) 


n     T  (n.    +    m.  )     T     (N   +    m    -    n.     -    n,     -    n_     -    rn       -    m,     -    m„  ) 
.    _  l  l  0  1  <d  0  1  Z 

1=0 
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and     p      -    0,      q       -    0   ,      q2    ;>    0   ,      pQ    +    qj    +    q2    ^    1    .      Letting 

w    =    p      +    q      +    q       and  integrating    q      and    q      over  their  ranges  yields, 

as  the  marginal  for     W    =    P      +    Q      +    Q     , 


L    (n     +    m.  )    -    1  N  +   m    -    2  (n.   +   m. )    -    1 

ii  11 

L)M  (w|N)     =     G      w    °  (1     -    w) 

for       0    <     w    <      1 


=     0  ,     otherwise, 


where 


G3 


r(N    +     m) 


T       L  (n.    +    m.  )    )    T[    N  +    m    -    L  (n.    +    m.  )    \ 
^0       x  1    >       v  o       1  l    J 


Thus,      W    =    P      +    Q      +    Q       is  a  beta  random  variable  with  parameters 

2  2 

L    (n.    +    m.  ),      N+m-li(n     +m).       It  can  be  seen  that    P      plus  the 

0        »  0        '  ° 

sum  of  any  of  the    Q.'s    will  be  a  beta  random  variable;     the  effect  of 

adding  additional    Q.'s    to    P      is  simply  to  transfer  the  corresponding 

(n.    +    m.  )'s    from  the  second  parameter  to  the  first.      The  sum  of  the 
ii 

two  parameters  in  the  density  function  of  P      plus  any  of  the    Q.'s    is  a 

K 
constant  and  always  equal  to     N   +    m     (m    =      L     m.    ,      and   N    is  equal 

i=0 

to  the  number  of  items  tested)  . 

To  see  the  significance  of  changes  in  the  relative  values  of  the 
two  parameters  of  a  beta  random  variable,    let  us  note  some  general 
results.      If  X    is  a  beta  random  variable  with  parameters    a   and   b 
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(thus,    the  density  for    X    is 


n  ,  ..  r(a    +    b)  a    -    1  b    -    1 

B(x;a,b)  =  r<a)  r(b)   x  (1  "  x) 


0   <    x  <    1 


and    a    is  the  first,     b    the   second  parameter)  ,     it  is  easily  shown  that 


the  mean  of  X    is 


a   +    b 


and  the  mode  of   X    (corresponding  to  the 


maximum  value  of    B  (  x  ;  a  ,  b)  )     is 


a    -    1 


Thus,    if  we  consider 


a   +    b    -    2 
a  beta  random  variable  for  which    a   +    b     is  fixed,    but    a    is  free  to  vary, 

the  larger  the  first  parameter  gets  the  further  to  the  right  both  the 

center  of  gravity   (mean)    and  the  maximum    (mode)    of     B(x;a,  b)     will 

be;     thus,    more  probability  is  concentrated  at  larger  values  of  X    . 

Thus,    the  density  function  of     P      +■    Q      +    Q       has  more  weight  for 

higher  values  than  does    P      +    Q 

Formally,    we  can  explicitly  write  the  density  function  for    Z  , 

given    A  ,     as 


1 


1 

L 


fz  (*|  A)    =        L 

x    =0     x2  =  0 


1  S                X.                                   1      -     X. 

2  n     a.    l  (1    -   a.)              l 

x    =0  i=l      l                    l 

s 


B  (z  ;   nn  +    rri       +      L,     x.    (n     +    m    )  , 
0  0  j        j  j 


N    +    n      +    m    -    m         -       L      x     (n     +    m    )  ) 
0  0  j       j  j 


where      B  (z  ;  a  ,  b)     is  the  density  function  of  a  beta  random  variable 
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with  parameters    a    and   b  .      Notice  that  the  latter  terms  in  this  sum 

(the  ones  with  the  most   x.'s    equal  to  one)    will  be  the  ones  with  most 

1 

probability  at  the  highest  values.      The  mean  value  of    Z   then  is  easily 
shown  to  be 


1 


Z    A  N  +    m 


1 

L 
,    -0 


1  s  x. 

L  n     a.     '   (1    -    a.) 

x    =0  i=l       l 

s 


1 


[ 


n      +    rri      +       L    x     (n     +    m    ) 
0  °  j=i     J        J  J      J 


Notice  that  the  mean  value  of    Z,    given   A,     will  increase  as    n.    increases, 

i   =    1  ,    2 s,     which  seems  rather  curious,    since  the  number  of 

times  a  mode  occurs  during  the    N  trials  does  not  affect  the  probability 

it  will  be  corrected  by  the  design  change. 

The  variance  of  achieved  reliability,    Z  ,     given  the  results  of  the 

N   tests,    can  be  computed  in  particular  cases  rather  easily;     however, 

a  general  expression  of  the  variance  of    Z    in  terms  of  the  variances  of 

P     ,    Q     ,    .  .  •    ,    Q       would  be  too  cumbersome  to  use.      It  is  easily  shown 
0  1  K. 

that  if  X    is  a  beta  random  variable  with  parameters    a   and   b  ,     then 


E  (X    )    = 


a   (a   +    1) 


(a    +    b)    (a   +    b   +    1) 


accordingly, 
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E  [  Z    I  A]     = 


1 


(N+m)  (N+m+1) 


1 
L     ' 


1 
L 

x   =0 

s 


S  X.  1  -X. 

n     a.     l  (1-a.)         *    C(x.  , 
i=l 


'*s> 


where 


C  (x     ,    x^  , 


.  .    ,   x 


)   =  [no 


+     m  ^     +       L     x.  (n.    +     m 
i=l 


s 
•      n.    +    mrt    +      L    x.  (n.    +    in.  )    +     1 


The  variance  of    Z  ,    given  the  results  of  the  N  tests,    then  is 


°Z|A    =     E  tzZ|A]     "    [E(Z|  A)]  2 


which  is  easily  evaluated  in  any  particular  case. 

Interval  statements  about    Z    are  easily  made.      Clearly, 


1 

P  (Z   >    b|   A)     =  f  (z|A|dz) 

Jb      Z|   A 


1 
L 


1  S  X. 


1     -    x. 


•  ■      2  n    a.        (1-a. 

x   =0  x   =0     i=l     * 

1  s 


1 


B(z;C,N+m-C)dz 


where 


C     =     n^    +    rri       +      L    x.  (n.    +     m.) 
0  0  ,       j  j 
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Thus,    for  any  given   b  ,     it  is  a  simple  table  lookup  to  evaluate  the  inte 
grals  involved  in  the  sum  which  determine  the  value  of  the  probability 
statements.      If  we  want  to  fix  the  value  of  the  probability  statement, 
at    .95    for  example,    we  can  use  the  fact  that     P  (  Z    >     b  I  A)    is  a 
monotonically  decreasing  function  of   b   to  numerically  zero  in  on  the 
desired  value  of   b    (for  the  fixed  probability)  . 

The  next  section  is  devoted  to  a  particular  numerical  example 
showing  the  determination  of  the  prior,    the  marginal  mean  of    Z  ,     the 
marginal  variance  of    Z  ,     and  the  value    b    such  that 

P(Z>b|A)     =     .95      . 
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4.       A  NUMERICAL  EXAMPLE 

Let  us   suppose  that  we  have  designed  an  item   (a  missile  or  com- 
ponent thereof,    for  example)    which  consists  of  four  subcomponents 
connected  in  series.      The    (unknown)    probabilities  that  these  four  will 
work  correctly  are  denoted  by     P       ,     P       ,     P       ,     P       ,    respectively. 
The  probability  that  one  of  the  items  works  correctly  then  is 
P       =     P    '     P    '     P        P    '      (the  initial  reliability)  .      The  probability  of 
observing  a  failure  in  mode  i,      i.  =    1  ,    2  ,    3  ,    4 ,      is 


1     -     P. 


Q. 


4 

L     P 


[1 


V 


Assume  that  the  following  table  gives  prior  failure  information  on 
each  of  the  four   subcomponents. 


Proportion 

Subcom- 

Number of 

of 

Estimated 

ponent 

Number 

Su 

ccesses 

Sue 

cesses 

Variance 

Number 

Tested 

r . 
l 

(in 

X. 

l 

r.    tests) 

P. 

l 

X. 

i 

r . 
l 

V. 
i 

_  pf(1-piS> 

i 

r 
l 

1 

1,  000 

990 

.99 

-  5 
.  99  x  10 

2 

10, 000 

9,  800 

.98 

.  196  x  10  "  5 

3 

5,  000 

4,  750 

.95 

.95x10" 

4 

200 

194 

.97 

1455  x  10 "3 
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Then,    using  the  method  suggested  in  section  2    to  estimate  the 

parameters  of  the  prior  for     P„  ,    Q    ,    Q„  ,    Q_,  ,    Q  „   ,    we  first  compute 

0  12  3  4 

the  estimated  initial  reliability  and  the  estimated  probabilities  of 
occurrence  of  the  four  failure  modes  using 


Po  »*, 


1    -  p. 
Q.    =    1—r     [  1     -    Pft  ]  ,      1=1,2,3,4     . 

4     -    L    P. 

J 

The  values  of  these  quantities  are  displayed  in  the  following  table. 


P  Q  Q  Q  Q 

0  1  2  3  4 


8940  .0096  .0193  .0482  .0289 


We  next  determine  the  value  of  m  ,     using  Silva's  method,    to  be 


L  [Q.]2    [1     -    Q.]2 

m     = -    1 

2  V.   [Q.  ]    [1    -    Q    ] 
li  i 


23.  76 


and  then  compute    m     ,    m^  ,    m^  ,    rn       by    m.    =    m  Q.  ,      i  =    1,    2,    3,    4 

12  3  4  i  l 

4 

(we  define    m       =    m  P       =    m     -      L    m.  )  .       This  yields    m      =    .  228  , 

i=l 

m       =     .459,     m       =     1.145,     m       =     .687,      and    m       =     21.241     . 
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These  values  of  m    and  the   m.'s  ,    then,    completely  specify  the  prior 

distribution  of     P         Q        Q^  ,    Q        Q      . 

Now,    let  us  assume  that    N    =    15    of  these  items  are  tested  and 

that  we  observe      n      =    13     successes  and     n      =    1     failure  in  mode  3 

and     n      =    1     failure  in  mode  4  .      The  two  failures  are  analyzed,    the 
4 

design  is  changed,    and  it  is  decided  that  mode  3    has  been  corrected 
with  probability    a      =    .9     and  that  mode  4   has  been  corrected  with 
probability    a      =    .99    . 

The  marginal  distribution  of  achieved  reliability    Z  ,     given  the 
results  of  the    15   tests,    is 

f     ,       (z|A)      =  .  001  B  (z  ;  34.  241   ,  4.  519) 

+  .  099  B  (z  ;  35.928  ,  2.  832) 

+  . 009  B  (z ;  36. 386  ,  2. 374) 

+  . 891  B  (z ;  38. 073  ,  0. 687) 

where     B(z  ;  a  ,    b)     again  is  the  density  function  of  a  beta  random  variable 
with  parameters    a    and   b  .      The  mean  value  of    Z    is 

^ZIA    =      38176      [('001)    (34-241>    +    (-099)   (35.928) 


+     (.009)    (36.386)     +     (.891)    (38.073)] 


.976      ; 


we  also  find 
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These  values  of  m    and  the   m.'s  ,    then,    completely  specify  the  prior 
distribution  of     P         Q         Q        Q        Q      . 

Now,    let  us  assume  that     N    =    15    of  these  items  are  tested  and 
that  we  observe      n      =    13     successes  and     n      =    1     failure  in  mode  3 

and     n      =    1     failure  in  mode  4  .      The  two  failures  are  analyzed,    the 

4 

design  is  changed,    and  it  is  decided  that  mode  3    has  been  corrected 

with  probability    a      =    .  9     and  that  mode  4   has  been  corrected  with 

probability    a  „    =    .99    . 
4 

The  marginal  distribution  of  achieved  reliability    Z  ,     given  the 
results  of  the    15   tests,    is 

f     ,       (z|A)      =  .  001  B  (z  ;  34.  241  ,  4.  519) 

+  .  099  B  (z  ;  35.928  ,  2.  832) 

+  . 009  B  (z ;  36. 386  ,  2.  374) 

+  .  891  B  (z  ;  38. 073  ,  0.  687) 

where     B(z  ;  a  ,    b)     again  is  the  density  function  of  a  beta  random  variable 
with  parameters    a    and   b  .      The  mean  value  of    Z    is 

^ZIA    =    "38^76"     t(-001)    (34-241)    +     (-099)    (35.928) 


+    (.009)    (36.386)    +    (.891)    (38.073)] 


976     ; 


we  also  find 
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E[Z2|A]     =       38   ?6  *  [(.001)   (1206.687)    +    (.099)    (1326.749) 

+    (.009)   (1360.327)    +    (.891)   (1487.626)] 
.9  540    . 

Then,    the  variance  of    Z    is 

aviA     =     -9540     -    (.976)2    =     .001424       , 

and  the   standard  deviation  of    Z    is 


°7  I  a     =    v.  001424    =     .  038 


Let  us  now  illustrate  the  computation  of  probability  statements 
about    Z  .       First,    the  probability  that    Z    exceeds    .95    is 


1 

i 
Z  A 


|  A)dz 


.95 

which  in  turn  is  equal  to  the  weighted  sum  of  the  integrals  of  the  four 

densities  which  make  up    f      (z  I  a)  .      Using  rough  interpolation  in 

Pearson's  tables  of  the  incomplete  beta-function   [4]  ,     we  find 

1 

B  (z  ;     34.  241   ,      4.  519)     =     .  069       , 

J  .95 

1 

B  (z;     35.928  ,      2.  832)     =     .  372       , 

J  .95 

1 

B  (z ;     36. 386  ,      2. 374)     =     .  453       ; 

J  .95 

1 

B  (z ;     38. 073  ,        . 687)     =     .918       ; 

J  .95 
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thus, 

P(Z    >    .95|A)    -    (.001)    (.069)    +    (.099)   (.372) 

+    (.009)    (.  453)    +    (.  891)    (.918) 
=      . 859    . 

Suppose  we  wanted  to  find  the  number    c    such  that 

P(Z>c|A)     =     .95  ; 

since  this  probability  is  a  noni  ncreasing  function  of   c  ,     we  know  that 
c   <    .95    .      We  then  try  a  value  of   c    (smaller  than   .  95  )     such  that 

P  (Z    >     c"~  |  A)    >     .95  ; 

then  this  new  value     c       and    c    =    .95    bracket  the  desired  value  of   c  ; 
and  by  trying  intermediate  values,    we  can  finally  find   c    such  that 

P(Z>c|A)     =     .95 

Specifically,    again  by  rough  interpolation  in  Pearson's  tables,    we  find 

P  (Z    >    .9  |  A)    -    .9666      , 

and  thus  the  desired  value  lies  between    .9     and    .95    .      By  trying 
further  values  between     .9    and    .95  ,     we  find  that 

P  (Z    >     .91  |  A)     =     . 9587 

P  (Z    >     .92 |  A)     =    . 9442      , 

and  thus  the  desired  value  lies  between    .91     and    .92  .      By  further 
interpolation  in  this  interval,    we  could  get  as  close  as  we  like  to  the 
value  having  probability    .95    . 
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5.        CONCLUSIONS,    RECOMMENDATIONS 

A  Bayesian  argument  has  been  put  forth  leading  to  a  completely- 
known  distribution  for  the  achieved  reliability  following  corrective 
action.      This  distribution  can  be  used  to  give  either  point  or  interval 
statements  about  the  final  reliability.      The  resulting  final  distribution 
is  dependent  upon  the  type  of  prior  assumed  for  the  parameters.      It  is 
felt  by  the  author  that  a  very  reasonable  prior  distribution  has  been 
assumed  for  the  parameters,    and  arguments  have  been  given  supporting 
this  feeling.      A  possible  topic  for  further  study,    should  this  particular 
model  prove  quite  useful,    would  be  to  study  the  manner  in  which  the 
marginal  distribution  for    Z    changes  as  the  assumed  prior  is  changed; 
if  the  final  distribution  for    Z    is  relatively  stable  for  a  wide  variety  of 
assumed  priors,    then  very  strong  conclusions  regarding    Z    can  be 
reached,    essentially  independent  of  the  assumed  prior. 

Rather  than  perform  the  sensitivity  analysis  just  mentioned,    the 
author  would  recommend  a  restructuring  of  the  model  to  make  it  more 
realistic.      There  seem  to  be  two  basic  weaknesses  in  the  model  assumed 
so  far:     the  first  of  these  is  the  fact  that  no  provision  is  made  in  the 
model  for  the  reliability  possibly  being  decreased  by  the  design  change, 
which  could  definitely  be  the  case  in  practical  situations;     the  second 
defect  is  the  assumption  that  all   N  tests  are  made  simultaneously  and 
that  a  single  design  change  is  made.      In  reality,    tests  of  expensive  pieces 
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this  feeling.      A  possible  topic  for  further  study,    should  this  particular 
model  prove  quite  useful,    would  be  to  study  the  manner  in  which  the 
marginal  distribution  for    Z    changes  as  the  assumed  prior  is  changed; 
if  the  final  distribution  for    Z    is  relatively  stable  for  a  wide  variety  of 
assumed  priors,    then  very  strong  conclusions  regarding    Z    can  be 
reached,    essentially  independent  of  the  assumed  prior. 

Rather  than  perform  the  sensitivity  analysis  just  mentioned,    the 
author  would  recommend  a  restructuring  of  the  model  to  make  it  more 
realistic.      There  seem  to  be  two  basic  weaknesses  in  the  model  assumed 
so  far:     the  first  of  these  is  the  fact  that  no  provision  is  made  in  the 
model  for  the  reliability  possibly  being  decreased  by  the  design  change, 
which  could  definitely  be  the  case  in  practical  situations;     the  second 
defect  is  the  assumption  that  all   N   tests  are  made  simultaneously  and 
that  a  single  design  change  is  made.      In  reality,    tests  of  expensive  pieces 
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of  equipment  proceed  sequentially;    the  first  time  a  failure  mode  occurs, 
an  attempt  is  made  to  remove  it  by  a  design  change.      Then,    testing 
resumes  on  the  new  type  of  design  until  a  failure  mode  occurs  again, 
etc.  ,    at  which  point  another  design  change  is  made.      This  practical 
sequential  ordering  of  changes  being  made  should  be  reflected  in  the 
model. 
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